manggo

MEDIUM

maintainer liblaf 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Installs a prebuilt proprietary binary (.deb) from gitcode.com (a Chinese code hosting platform, not the project's own infrastructure), which is an unverifiable prebuilt executable; however checksums are provided and the source appears to be the project's own release page, reducing but not eliminating supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 source_x86_64=("manggo_${pkgver}_amd64.deb::https://gitcode.com/Pylogmon/Manggo/releases/download/${pkgver}/manggo_${pkgver}_amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary binary (.deb) from gitcode.com (a Chinese code hosting platform, not the project's own infrastructure), which is an unverifiable prebuilt executable; however checksums are provided and the source appears to be the project's own release page, reducing but not eliminating supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: liblaf <30631553+liblaf@users.noreply.github.com>
    
      2# SPDX-License-Identifier: 0BSD
    
      3# shellcheck shell=bash disable=SC2034,SC2154
    
      4
    
      5pkgname=manggo
    
      6pkgver=1.1.2
    
      7pkgrel=1
    
      8pkgdesc='Desktop translation and screenshot OCR assistant'
    
      9arch=('x86_64' 'aarch64')
    
      10url='https://manggo.pylogmon.cn/'
    
      11license=('LicenseRef-Manggo-Proprietary')
    
      12depends=(
    
      13  'dbus'
    
      14  'fontconfig'
    
      15  'freetype2'
    
      16  'gcc-libs'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'hicolor-icon-theme'
    
      20  'krb5'
    
      21  'libdrm'
    
      22  'libglvnd'
    
      23  'libpulse'
    
      24  'libx11'
    
      25  'libxcb'
    
      26  'libxext'
    
      27  'libxkbcommon'
    
      28  'libxkbcommon-x11'
    
      29  'libxrandr'
    
      30  'mesa'
    
      31  'openssl'
    
      32  'shared-mime-info'
    
      33  'wayland'
    
      34  'xcb-util'
    
      35  'xcb-util-cursor'
    
      36  'xcb-util-image'
    
      37  'xcb-util-keysyms'
    
      38  'xcb-util-renderutil'
    
      39  'xcb-util-wm'
    
      40  'zlib'
    
      41  'zstd'
    
      42)
    
      43depends_aarch64=(
    
      44  'brotli'
    
      45  'gst-plugins-bad-libs'
    
      46  'gst-plugins-base-libs'
    
      47  'gst-plugins-good'
    
      48  'gstreamer'
    
      49  'libice'
    
      50  'libsm'
    
      51)
    
      52makedepends=('patchelf')
    
      53optdepends=(
    
      54  'at-spi2-core: accessibility support for selection features'
    
      55  'libpipewire: PipeWire audio and screen capture integration'
    
      56  'libva: VA-API video acceleration (also requires a driver for your GPU)'
    
      57  'wl-clipboard: clipboard integration on Wayland'
    
      58  'xdg-desktop-portal: desktop integration on Wayland (install a backend for your desktop)'
    
      59)
    
      60# Preserve bundled libraries, Qt plugins, models, and relative library paths.
    
      61options=('!strip' '!debug')
    
      62source_x86_64=("manggo_${pkgver}_amd64.deb::https://gitcode.com/Pylogmon/Manggo/releases/download/${pkgver}/manggo_${pkgver}_amd64.deb")
    
      63sha256sums_x86_64=('e87ddf5fa75323bfcffae6786616a89f18fff09f4d9ff5156e2447d63eb82343')
    
      64source_aarch64=("manggo_${pkgver}_arm64.deb::https://gitcode.com/Pylogmon/Manggo/releases/download/${pkgver}/manggo_${pkgver}_arm64.deb")
    
      65sha256sums_aarch64=('7dec16e6cdaebc3f3bc50b9142f651e0290cd00911f59a41663574fc58bcdc6e')
    
      66
    
      67package() {
    
      68  bsdtar -xf "${srcdir}/data.tar.gz" -C "${pkgdir}"
    
      69
    
      70  # This Apache-2.0 library leaks an upstream CI path; use its bundled peers.
    
      71  # shellcheck disable=SC2016
    
      72  patchelf --set-rpath '$ORIGIN:$ORIGIN/..' \
    
      73    "${pkgdir}/usr/lib/manggo/bin/libsherpa-onnx-c-api.so"
    
      74
    
      75  # Keep the upstream executable name for desktop actions and plugin handling.
    
      76  ln -s Manggo "${pkgdir}/usr/bin/manggo"
    
      77
    
      78  install -Dm644 "${pkgdir}/usr/share/doc/Manggo/LICENSE" \
    
      79    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      80  install -Dm644 "${pkgdir}/usr/share/doc/Manggo/USER_AGREEMENT.zh-CN.txt" \
    
      81    "${pkgdir}/usr/share/licenses/${pkgname}/USER_AGREEMENT.zh-CN.txt"
    
      82}
    
      83

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 17:18:25	Medium	3
2026-10-16 17:16:11	Medium	3